What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your YouTrack instance:- Accounts - every user, with their name, login, email address, sign-in methods (password, including LDAP, or single sign-on), two-factor authentication status and method (authenticator app or WebAuthn security key), last access, last password change, when they were created, and whether they’re banned. System Admin holders are marked as administrators. On YouTrack 2026.2 or later, the license type comes from each user’s YouTrack user type: reporters are free, standard users and agents are paid. Helpdesk reporters are shown as external users, and the guest account represents anonymous visitors.
- Non-human identities - every permanent token and application password, each paired with a credential that shows its owner, when it was created and last used, and, for permanent tokens, who created it and the services its scope covers. Oleria also lists the OAuth clients registered in Hub (Hub services), with when each one was created and who created each one you added, when the audit log still holds its creation event. Oleria never reads token values or client secrets.
- Groups - custom groups, project teams, and the built-in Registered Users and All Users groups, with their members and, from the audit log, when each custom group and team was created. Nested groups and groups added to a project team are linked to their parent.
- Roles - every YouTrack role, built-in and custom, and who holds it, directly or through a group. A role granted in one project or organization appears as a separate role for that project or organization, such as
Project Admin (DEMO), so a scoped grant isn’t mistaken for a global one. - Resources - projects and organizations, with each project’s creation date from the audit log, the projects each organization contains, the permissions each role grants on them, and each project’s owner (leader). A role with project permissions that’s granted globally applies to every project, and a role granted in an organization applies to the organization and all its projects.
- Activity - the Hub audit log: bans and unbans, password changes, group and role grants, token and OAuth client changes, sign-in module changes, and other configuration changes. Each event reads as a sentence, such as “admin removed user group Contractors”, and events on a project link to the project in YouTrack.
Oleria doesn’t import issues, articles, or issue-level visibility settings.
Prerequisites
- YouTrack Cloud or YouTrack Server 2026.1 or later. Oleria refuses older versions when you connect, because the group, role, and role-grant APIs it reads were added in 2026.1.
- A YouTrack user with the System Admin role, or a custom role with the permissions below, granted in the global scope. A dedicated service account is recommended: the token acts as this user and stops working if the user is banned or removed.
- Admin access to the Oleria workspace.
YouTrack Server must be reachable from Oleria over HTTPS at a public address. Before you connect, contact support@oleria.com to have your server’s address allowlisted.
Required permissions
The System Admin role covers everything. If you use a custom role, grant it in the global scope: Oleria checks the token’s global permissions before an action runs. Read permissions, for discovery:
Oleria needs all of them for a complete sync. YouTrack hides what a token can’t see instead of returning a permission error, so when you select Authenticate, Oleria reads the token’s effective permissions and refuses the token if any of these are missing, naming them.
Write permissions, only if you want Oleria to take remediation actions:
Create a permanent token
1
Sign in as the connection user
Sign in to YouTrack as the user that holds the System Admin role or your custom role.
2
Create the token
Open your profile, go to Account Security -> Tokens, and create a new permanent token. Its scope must include both YouTrack and YouTrack Administration. Oleria reads accounts, tokens, and the audit log through YouTrack Administration, and refuses a token without it.
3
Copy the token
Copy the token.
Connect YouTrack to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the YouTrack tile.
2
Complete the connection form
3
Authenticate
Select Authenticate. Oleria checks that the token can call both YouTrack and YouTrack Administration, that the instance runs 2026.1 or later, and that the token holds the five read permissions above, then saves the integration.
Verify the integration
Confirm YouTrack appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered accounts, groups, roles, projects, and tokens in your Oleria workspace.If you revoke or replace the permanent token in YouTrack, update it in Oleria by editing the integration.
Remediation actions
Beyond discovery, Oleria can act on YouTrack access to remediate risk. Remediation needs the write permissions described above. Oleria checks the token’s permissions before an action runs and reports any that are missing.
Oleria never bans or deletes the user the connection authenticates as, never removes that user from a group, project team, or role, and never revokes any of that user’s permanent tokens or application passwords, including the connection’s own token. It never deletes the guest account.
Known limitations
- No sign-in events. The Hub audit log doesn’t record sign-ins, sign-outs, or failed sign-ins. Dormant account detection uses each account’s last access time in Hub.
- OAuth client secrets aren’t available. Hub doesn’t return the client secret of an OAuth client (Hub service), so Oleria shows no credential for it. Hub has no way to disable an OAuth client, so Disable NHI doesn’t cover them.
- Some credentials aren’t collected. Oleria doesn’t inventory OAuth refresh tokens, SSH keys, or OAuth consents.
- Two-factor authentication shows Hub’s own enrollment. YouTrack asks for Hub two-factor only on password sign-ins. A user who signs in only through single sign-on shows Required if they enrolled in Hub two-factor, and Not required (or Enrollment required, when a group requires it) otherwise, whatever your identity provider enforces.
- Group role grants aren’t changed by actions. Remove user from role and Revoke permission change only the roles a user holds directly. To remove access a user gets through a group, remove them from the group, or change the group’s roles in YouTrack.
- Only project events link to a project. Audit events about settings, permissions, users, groups, and roles aren’t linked to a project.
- Missing read permissions don’t show on the Capabilities tab. YouTrack returns no permission errors for reads, so Oleria checks them when you select Authenticate and names any that are missing, as described in Required permissions.
- Identity provider links cover Okta’s default issuer only. Oleria links YouTrack to an Okta SAML app that uses Okta’s default issuer,
http://www.okta.com/<app key>. Apps on a custom Okta domain or on other identity providers share one issuer across apps, so Oleria doesn’t link them. - YouTrack 2026.1 or later only. Older versions are refused when you connect.